The HTTP Content-Security-Policy
(CSP) child
-src
directive defines the valid sources for web workers and nested browsing contexts loaded using elements such as <frame>
and <iframe>
. For workers, non-compliant requests are treated as fatal network errors by the user agent.
CSP version | 2 |
---|---|
Directive type | Fetch directive |
default-src fallback | Yes. If this directive is absent, the user agent will look for the default-src directive. |
One or more sources can be allowed for the child-src policy:
Content-Security-Policy: child-src <source>; Content-Security-Policy: child-src <source> <source>;
<source> can be one of the following:
'*'
), and you may use a wildcard (again, '*'
) as the port number, indicating that all legal ports are valid for the source.http://*.example.com
: Matches all attempts to load from any subdomain of example.com using the http:
URL scheme.mail.example.com:443
: Matches all attempts to access port 443 on mail.example.com.https://store.example.com
: Matches all attempts to access store.example.com using https:
.data:
Allows data:
URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.
mediastream:
Allows mediastream:
URIs to be used as a content source.blob:
Allows blob:
URIs to be used as a content source.filesystem:
Allows filesystem:
URIs to be used as a content source.'self'
blob
and filesystem
from source directives. Sites needing to allow these content types can specify them using the Data attribute.'unsafe-inline'
<script>
elements, javascript:
URLs, inline event handlers, and inline <style>
elements. You must include the single quotes.'unsafe-eval'
eval()
and similar methods for creating code from strings. You must include the single quotes.'none'
strict-dynamic
source expression specifies that the trust explicitly given to a script present in the markup, by accompanying it with a nonce or a hash, shall be propagated to all the scripts loaded by that root script. At the same time, any whitelist or source expressions such as 'self'
or 'unsafe-inline'
will be ignored. See script-src for an example.Given this CSP header:
Content-Security-Policy: child-src https://example.com/
This <iframe>
and worker are blocked and won't load:
<iframe src="https://not-example.com"></iframe> <script> var blockedWorker = new Worker("data:application/javascript,..."); </script>
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 The definition of 'child-src' in that specification. | Editor's Draft | No changes. |
Content Security Policy Level 2 The definition of 'child-src' in that specification. | Candidate Recommendation | Initial definition. |
Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Servo |
---|---|---|---|---|---|---|---|
Basic Support | 40 | No support | 45.0 | No support | 27 | 10 | ? |
Feature | Android | Chrome for Android | Edge Mobile | Firefox for Android | IE Mobile | Opera Mobile | Safari Mobile |
---|---|---|---|---|---|---|---|
Basic Support | ? | (Yes) | No support | 45.0 | No support | ? | 9.3 |
© 2005–2017 Mozilla Developer Network and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src